After running an upgade (or FFU) with Ceph, the firewall rules for CephMgr are not configured on the nodes. It seems that the DeploySteps resources were disabled and prevented puppet from running when it should not have.
*** Bug 1572533 has been marked as a duplicate of this bug. ***
verified on openstack-tripleo-heat-templates-8.0.2-17.el7ost.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:2086